dependencykfeg

dependencykfeg 25.0.3, 25.1.3 and 25.1.9 contain no code of their own and declare a single dependency that npm fetches from a tarball in the GitHub repository `GamerD11/ping_test` (`https://github.com/GamerD11/ping_test/raw/refs/heads/main/node-acct-utils-1.0.0.tgz`), whose `preinstall` script runs `node index.js` on install. The first version of the tarball sends the username, hostname, home and working directories, platform, architecture and Node.js version in an HTTP POST to `yrtew6v4g3w9myixyizv5cvfa6gx4zso.oastify.com`; the current version, swapped in on 2026-10-29, reads the collector host from `burp_collaborator.txt` in the same repository, adds the machine's public IP address, network operator and ASN from `ipinfo.io`, and sends everything over HTTPS with certificate verification disabled. The packages have no legitimate functionality, the data is collected without the user's knowledge, and because the install-time code lives outside the registry on a mutable branch, the publisher can replace it with a harmful payload at any time without a new npm release. Any machine that installed one of these versions has disclosed its identity and network location to a third party; the other published versions are not part of this report.

---
_-= Per source details. Do not edit below this line.=-_

Source: amazon-inspector (00471403176b4d4a2c208c0a024688d9d98c69f0bbe9d719b7d72289b37ea6d9)
package.json declares a dependency `node-acct-utilssss21` whose source is a mutable GitHub raw tarball URL (`https://github.com/GamerD11/ping_test/raw/refs/heads/main/node-acct-utils-1.0.0.tgz`) rather than a registry version range. `npm install` fetches and installs whatever bytes that URL returns, with no version pin and no integrity check, and runs any lifecycle scripts contained in the fetched tarball. Whoever controls the `GamerD11/ping_test` repository controls code installed on the consumer's machine. The package also declares itself (`dependencykfeg@^25.1.3`) as one of its own dependencies, and the tarball ships no source file for the `main` entry it references, so the manifest's off-registry URL is effectively the package's entire payload. The implausibly high version number (25.2.1) relative to any plausible early-release library combined with the dependency-confusion-shaped self-reference is consistent with a package engineered to win internal name resolution.

Source: ghsa-malware (b1d6fe89dfa7e3ac7b6bb69388ac3d1584a4756a53f2b58f490739f409663324)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.